Privacy Policy

Effective date: November 1, 2025 · Last updated: November 1, 2025

Welcome to NairaHost. This Privacy Policy applies to our website nairahost.com.ng, our client area, and all services we provide. By using NairaHost services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

1. Who We Are & How to Contact Us

NairaHost is a Nigerian web hosting company providing domain registration, web hosting, VPS, managed hosting, reseller hosting, email hosting, and related services. We are committed to transparency and protecting your personal data in accordance with Nigerian law.

2. Information We Collect

We collect different types of information depending on how you interact with our services:

2.1 Personal Information

Information that identifies you as an individual:

• Identity Information: Full name, username, title, date of birth
• Contact Information: Email address, phone number, WhatsApp number, postal address
• Business Information: Company name, business registration number, VAT/Tax ID, business address
• Account Credentials: Username, password (stored encrypted), security questions
• Financial Information: Billing address, payment card details (last 4 digits), bank account information, transaction history
• Identification Documents: National ID, driver's license, international passport, business registration certificate (for verification purposes)

2.2 Service Usage Information

• Hosting Data: Domain names, website files, databases, email content (stored on our servers)
• Technical Data: IP addresses, browser type, operating system, device information
• Usage Data: Login times, pages visited, features used, bandwidth consumption, resource usage
• Support Data: Support ticket content, chat logs, email correspondence, phone call records
• Performance Data: Server logs, error logs, uptime statistics, resource monitoring data

2.3 Automatically Collected Information

• Cookies & Similar Technologies: Session cookies, preference cookies, analytics cookies
• Log Files: Access logs, error logs, security logs
• Analytics Data: Google Analytics data, website traffic statistics
• Marketing Data: Email open rates, click-through rates, campaign performance

2.4 Information We Don't Collect

3. How We Collect Information

We collect information through various methods:

3.1 Direct Collection

• Account Registration: When you sign up for services
• Service Orders: When you purchase hosting, domains, or add-ons
• Contact Forms: When you submit inquiries or contact us
• Support Tickets: When you request technical assistance
• Email/Phone/Chat: When you communicate with our team
• Surveys & Feedback: When you participate in surveys or provide feedback

3.2 Automatic Collection

• Website Cookies: Browser cookies track your preferences and usage
• Server Logs: Our servers automatically log access and errors
• Analytics Tools: Google Analytics and similar tools track website behavior
• Email Tracking: Email open and click tracking for marketing emails

3.3 Third-Party Sources

• Payment Processors: Paystack, Flutterwave provide transaction details
• Domain Registries: WHOIS data from domain registrations
• Fraud Prevention Services: MaxMind, fraud detection tools
• Social Media: If you link social accounts or share content

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 Service Provision

• Creating and managing your account
• Provisioning and delivering hosting services
• Processing domain registrations and renewals
• Managing billing and payments
• Providing technical support and customer service
• Performing backups and disaster recovery
• Monitoring service performance and uptime

4.2 Service Improvement

• Analyzing usage patterns to improve services
• Developing new features and products
• Conducting research and analytics
• Testing and troubleshooting new technologies

4.3 Communication

• Sending service notifications (renewal reminders, maintenance alerts)
• Responding to inquiries and support requests
• Providing account updates and important announcements
• Sending marketing communications (with your consent)
• Conducting customer satisfaction surveys

4.4 Security & Fraud Prevention

• Detecting and preventing fraud, abuse, or security threats
• Enforcing our Terms of Service and Acceptable Use Policy
• Protecting our infrastructure and other customers
• Verifying identity for high-risk transactions
• Investigating policy violations

4.5 Legal Compliance

• Complying with Nigerian laws and regulations
• Responding to legal requests and court orders
• Maintaining records for tax and accounting purposes
• Enforcing our legal rights and defending against claims

5. Legal Basis for Processing (NDPR Compliance)

Under the Nigeria Data Protection Regulation (NDPR), we must have a legal basis for processing your personal data. We process your data based on:

5.1 Contract Performance

Processing is necessary to fulfill our contract with you (Terms of Service). This includes:

• Providing hosting services you've purchased
• Managing your account and billing
• Delivering technical support

5.2 Consent

You have given explicit consent for specific purposes:

• Marketing communications and newsletters
• Non-essential cookies and analytics
• Sharing data with third parties beyond service provision

You can withdraw consent at any time without affecting other services.

5.3 Legitimate Interests

Processing is necessary for our legitimate business interests:

• Fraud prevention and security
• Network and information security
• Internal administration and business operations
• Analyzing and improving our services

5.4 Legal Obligation

Processing is required to comply with Nigerian law:

• Tax and accounting records
• Anti-money laundering (AML) compliance
• Response to law enforcement requests
• ICANN WHOIS requirements for domains

6. Data Retention & Storage

6.1 How Long We Keep Your Data

Data Type	Retention Period	Reason
Active Account Data	Duration of service + 30 days	Service provision
Billing Records	7 years after transaction	Tax & legal compliance
Support Tickets	3 years after closure	Quality assurance & legal
Server Logs	30-90 days	Security & troubleshooting
Marketing Data	Until consent withdrawn	Marketing purposes
Hosted Content	14-30 days after termination	Grace period for recovery

6.2 Data Storage Location

• Primary Location: Data centers in Lagos, Nigeria
• Backup Location: Secure offsite backup facilities
• Cloud Services: Some services may use international cloud providers (with appropriate safeguards)

6.3 Data Deletion

When retention periods expire or you request deletion:

• Personal data is securely deleted or anonymized
• Backups are purged according to backup rotation schedules
• Some data may be retained in anonymized form for analytics
• Legal or regulatory requirements may require longer retention for specific data

7. How We Protect Your Information

We implement comprehensive security measures to protect your personal data:

7.1 Technical Security

• Encryption:
  • SSL/TLS encryption for data in transit (website, email, client area)
  • Encrypted storage for sensitive data (passwords hashed with bcrypt/Argon2)
  • Database encryption for financial information
• Access Controls:
  • Role-based access control (RBAC) for staff
  • Two-factor authentication (2FA) available for customers
  • IP whitelisting for administrative access
• Network Security:
  • Firewall protection on all servers
  • DDoS mitigation and traffic filtering
  • Intrusion detection and prevention systems (IDS/IPS)
  • Regular security patching and updates

7.2 Organizational Security

• Staff Training: Regular security and privacy training for all employees
• Background Checks: Screening for employees with data access
• Confidentiality Agreements: All staff sign NDAs
• Access Logging: All data access is logged and monitored
• Security Audits: Regular internal and external security audits

7.3 Physical Security

• 24/7 monitored data centers
• Biometric access controls
• CCTV surveillance
• Redundant power and cooling systems

8. Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device that help websites remember your preferences and improve your experience.

8.2 Types of Cookies We Use

Cookie Type	Purpose	Required?
Essential Cookies	Login sessions, shopping cart, security features	Yes - Required for site functionality
Functional Cookies	Remember preferences, language settings	No - Improve experience
Analytics Cookies	Google Analytics, usage statistics, performance monitoring	No - Help us improve
Marketing Cookies	Track conversions, retargeting, advertising effectiveness	No - Marketing purposes

8.3 Third-Party Cookies

We use the following third-party services that may set cookies:

• Google Analytics: Website traffic analysis and user behavior
• Facebook Pixel: Ad targeting and conversion tracking
• Google Ads: Advertising and remarketing
• Hotjar/Similar: Heatmaps and user experience analysis

8.4 Managing Cookies

You can control cookies through:

• Browser Settings: Most browsers allow you to refuse or delete cookies
• Cookie Consent Banner: Manage preferences via our cookie banner
• Opt-Out Tools: Google Analytics Opt-out, DAA WebChoice Tool

Note: Disabling essential cookies may prevent some website features from working properly.

8.5 Do Not Track (DNT)

We currently do not respond to "Do Not Track" signals, but you can control tracking through cookie settings and opt-out tools.

9. Third-Party Services & Data Sharing

9.1 When We Share Your Data

We DO NOT sell, rent, or trade your personal information to third parties for their marketing purposes.

We only share your data with third parties in these limited circumstances:

9.2 Service Providers

We share data with trusted third-party service providers who help us operate our business:

• Payment Processors: Paystack, Flutterwave (for processing payments)
• Domain Registries: Verisign, NIRA, ICANN registries (for domain registration)
• SSL Providers: Let's Encrypt, Sectigo, DigiCert (for SSL certificates)
• Email Services: SendGrid, Mailgun (for transactional emails)
• Support Tools: WHMCS, helpdesk software (for customer support)
• Analytics: Google Analytics (for website analytics)
• CDN Providers: Cloudflare (for content delivery and DDoS protection)
• Backup Services: Secure backup and disaster recovery providers

All service providers are contractually bound to protect your data and only use it for specified purposes.

9.3 Legal Requirements

We may disclose your information when required by law:

• Court orders, subpoenas, or legal processes
• Law enforcement or government agency requests (with valid legal authority)
• Compliance with Nigerian laws and regulations
• Protection of our legal rights or property
• Investigation of fraud, security issues, or policy violations

9.4 Business Transfers

If NairaHost is involved in a merger, acquisition, or sale of assets, your data may be transferred to the new entity. We will notify you and ensure continued protection of your data.

9.5 With Your Consent

We may share data with other third parties if you explicitly consent (e.g., integration with third-party tools you authorize).

10. International Data Transfers

While we primarily store data in Nigeria, some services may involve international data transfers:

10.1 Why Data May Leave Nigeria

• Global CDN and DDoS protection services (Cloudflare)
• International payment processing (Paystack, Flutterwave)
• Domain registration with international registries
• Cloud backup and disaster recovery
• Analytics and business intelligence tools

10.2 Safeguards for International Transfers

When transferring data internationally, we ensure:

• Transfer only to countries with adequate data protection (EU, USA with Privacy Shield alternatives)
• Use of Standard Contractual Clauses (SCCs) approved by NDPR
• Service providers certified under privacy frameworks (ISO 27001, SOC 2)
• Encryption during transit and at rest

10.3 Your Rights Regarding International Transfers

You have the right to:

• Know which countries your data is transferred to
• Request information about safeguards in place
• Object to transfers in certain circumstances

11. Your Privacy Rights (NDPR/GDPR)

Under the Nigeria Data Protection Regulation (NDPR) and similar laws, you have the following rights:

11.1 Right to Access

• Request a copy of your personal data we hold
• Receive information about how we process your data
• Access data in a commonly used, machine-readable format

How to exercise: Email privacy@nairahost.com.ng with "Data Access Request" in the subject line.

11.2 Right to Rectification

• Correct inaccurate or incomplete personal data
• Update your contact information and account details

How to exercise: Log into your client area and update your profile, or contact support.

11.3 Right to Erasure ("Right to be Forgotten")

• Request deletion of your personal data
• Have data erased when no longer necessary for original purpose
• Withdraw consent where processing is based on consent

Limitations: We may retain data required for legal obligations, contract performance, or legitimate interests (e.g., fraud prevention).

How to exercise: Email privacy@nairahost.com.ng or close your account in the client area.

11.4 Right to Restrict Processing

• Request limitation of how we process your data
• Object to processing in certain circumstances

11.5 Right to Data Portability

• Receive your data in a structured, commonly used format
• Transfer data to another service provider

11.6 Right to Object

• Object to processing based on legitimate interests
• Object to direct marketing at any time
• Opt out of profiling and automated decision-making

11.7 Right to Withdraw Consent

• Withdraw consent for marketing communications
• Opt out of non-essential cookies
• Cancel consent for data sharing with third parties

11.8 How to Exercise Your Rights

11.9 Right to Lodge a Complaint

If you believe we have violated your privacy rights or NDPR requirements, you have the right to lodge a complaint with:

12. Children's Privacy

NairaHost services are not intended for children under 18 years of age.

• We do not knowingly collect personal information from children
• Our Terms of Service require users to be at least 18 years old
• If we discover we have collected data from a child, we will promptly delete it
• Parents/guardians who believe their child provided information should contact us immediately

13. Marketing Communications

13.1 Types of Communications

Transactional Emails (Cannot Opt-Out):

• Order confirmations and receipts
• Service renewal reminders
• Payment confirmations and invoices
• Security alerts and password resets
• Support ticket updates
• Service maintenance notifications

Marketing Emails (Can Opt-Out):

• Promotional offers and discounts
• New product announcements
• Newsletter and blog updates
• Tips and tutorials
• Customer surveys

13.2 How to Opt-Out of Marketing

• Unsubscribe Link: Click "Unsubscribe" at the bottom of any marketing email
• Client Area: Update email preferences in your account settings
• Email Us: Send request to privacy@nairahost.com.ng
• WhatsApp: Reply "STOP" to opt out of WhatsApp marketing messages

Note: Opting out of marketing does not affect essential service communications.

13.3 SMS/WhatsApp Marketing

• We send marketing messages via SMS/WhatsApp only with your consent
• Reply "STOP" or "UNSUBSCRIBE" to opt out at any time
• Standard messaging rates may apply from your carrier

14. Data Breach Notification

We take data security seriously and have procedures in place to handle potential data breaches:

14.1 Our Commitment

• Continuous monitoring for security threats
• Incident response team ready to act immediately
• Regular security audits and penetration testing

14.2 In Case of a Breach

If a data breach occurs that poses a risk to your rights and freedoms, we will:

• Notify affected customers within 72 hours of discovering the breach
• Report to the Nigeria Data Protection Bureau (NDPB) as required
• Provide details about:
  • Nature of the breach and data affected
  • Potential consequences
  • Measures taken to address the breach
  • Steps you should take to protect yourself
• Offer assistance such as credit monitoring or identity protection where appropriate

14.3 Your Actions

If you suspect your account has been compromised:

• Change your password immediately
• Enable two-factor authentication
• Contact us at security@nairahost.com.ng
• Monitor your account for suspicious activity

15. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations.

15.1 How We Notify You

• Website Update: Updated policy posted with new "Last Updated" date
• Email Notification: For material changes affecting your rights, we'll send email notice at least 30 days in advance
• Client Area Notice: Banner notification when you log in
• Version History: Previous versions archived for reference

15.2 Your Acceptance

• Continued use of services after changes constitutes acceptance
• If you don't agree with changes, you may close your account
• Material changes won't apply retroactively without your consent

15.3 Policy History

You can request previous versions of our Privacy Policy by contacting privacy@nairahost.com.ng.

16. Contact & Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

---

Summary of Key Points